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We introduce a new class of graphs which we call P-transitive graphs, lying between transitive and 
3-transitive graphs. First we show that the analogue of de Jongh-Sambin Theorem is false for well- 
founded P-transitive graphs; then we show that the /i-calculus fixpoint hierarchy is infinite for P- 
transitive graphs. Both results contrast with the case of transitive graphs. We give also an undecid- 
ability result for an enriched /i-calculus on P-transitive graphs. Finally, we consider a polynomial 
time reduction from the model checking problem on arbitrary graphs to the model checking problem 
on P-transitive graphs. All these results carry over to 3-transitive graphs. 



1 Introduction 



The modal /i-calculus, introduced in 11151 . is a powerful logic for reasoning on systems, modeled as 
graphs. It is extensively used in computer science for verification of systems, both software and hardware. 
Formally, the /i-calculus is the extension of modal logic with the least fixpoint operator, /i, and the 
greatest fixpoint operator, v. Intuitively, /i corresponds to inductive definitions, and is used to express 
liveness properties; and v corresponds to coinductive definitions, and is used to express safety properties. 
Moreover, one is allowed to combine /i and v, and this gives more power in general, e.g. we can express 
fairness properties with a v followed by a /i. When several fixpoint alternations are present in a /i- 
calculus formula, the meaning of the formula is often hard to understand. However, it has been shown 
that the number of fixpoint alternations gives an infinite hierarchy on the class of all graphs, see [0 and 
PI . Things may change if one restricts attention to special classes of graphs. 

One of the most important classes of graphs is the class of all wellfounded transitive graphs. The 
corresponding modal logic, Godel-Lob logic GL, is in fact the modal logic of provability in Peano Arith- 
metic, a logic deeply studied since the Seventies at least. Actually, it is known that in GL, fixpoints 
are redundant; this follows from the famous de Jongh-Sambin Theorem, see |[T8l . saying that GL modal 
fixpoint equations, in a very general form, have a unique solution, and that this solution is expressed by 
a modal formula. So, in GL, the /i-calculus collapses to modal logic. A recent simple proof of the de 
Jongh-Sambin Theorem has been given by Alberucci and Facchini, see HI. 

It is interesting to look for possible generalizations of the de Jongh-Sambin Theorem. It is known 
that there is a collapse of the /i-calculus on transitive graphs, not to modal logic, but to the second level 
of the fixpoint hierarchy, see JH, ifTOll and iTTTTl : moreover, on arbitrary wellfounded graphs, it is known 
that one type of fixpoint is enough to express the whole /i-calculus (but fixpoints cannot be eliminated). 
In the same vein, we could for instance relax the notion of transitivity in some way. 

A natural relaxation of transitivity is ^-transitivity, where k is a positive integer: a graph is ^-transitive 
if every point reachable in finitely many steps is reachable in at most k steps. We maintain that k- 
transitivity has some practical motivation in relation to (bounded) model checking. Let us expand on this 
point. 
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Recall that the model checking problem for a logic is: given a finite graph (which models a finite- 
state system) and a formula of the logic, decide whether the formula is true in the graph. This formalizes 
the idea of proving the correctness of a system. When the logic is the jU -calculus or some fragments of it, 
as is often the case, one speaks of /I -calculus model checking. The theoretical status of /I -calculus model 
checking is open, in the sense that it is in NP (hence also in co — NP by complementation) but it is not 
known whether it is in P. However, given the practical importance of model checking, it is interesting to 
look for practical model checking algorithms. Two important techniques in this sense are the Symbolic 
Model Checking, see lPT6ll , and the Bounded Model Checking, see |@). 

In Symbolic Model Checking, the states and the relations of a system are modeled by Boolean func- 
tions, and these functions are typically encoded in Binary Decision Diagrams, which are often much 
more succinct than the truth-table representation of the function. 

In Bounded Model Checking, instead, one operates as follows. Given a system, first one fixes a 
positive integer k and considers only those states of the system which are reachable in k steps from the 
initial state. This means that if the graph is ^-transitive, the entire space of reachable states is considered; 
if there are points not reachable in k steps, they are discarded or considered later on. This approach is 
sensible because, for instance, real computer networks are often ^-transitive for quite small k, say k < 20. 
Next one reduces the model checking problem to a propositional satisfiability problem, and the key point 
is to make this reduction efficient. Finally, one uses a SAT solving algorithm. It must be remarked that, 
despite the theoretical intractability of the SAT problem, very efficient SAT solvers exist and are being 
constantly developed, see iMTl . Thanks to ^-transitivity, Bounded Model Checking often solves problems 
which are intractable with the usual techniques of Symbolic Model Checking (however one must admit 
that the contrary is also true). 

In this paper, the final goal is to obtain some properties of ^-transitive graphs. The main technical 
tool used for our results is a new notion of relaxed transitivity which we call P-transitivity, lying between 
transitivity and 3 -transitivity. Here P denotes a special atomic proposition which may be true or false 
on a vertex of a graph. In some respect, P-transitive graphs behave better than ^-transitive graphs, for 
instance there is a natural notion of P-transitive closure of a graph. 

The focus of this paper is on the pL -calculus and its fragments on P-transitive graphs; we give de- 
cidability and undecidability results as well as expressiveness results. Most of our results extend to 
^-transitive graphs (in particular to 3-transitive graphs). 

First, we prove that the satisfiability problem of the usual /I -calculus on P-transitive graphs is decid- 
able. Then, by contrast, we show that the satisfiability problem on P-transitive graphs for an enriched 
fi -calculus essentially taken from @ is undecidable. The undecidability result carries over to 3-transitive 
graphs. 

The expressiveness results are the following. First, the analogue of de Jongh-Sambin Theorem is 
false for wellfounded P-transitive graphs: on these graphs, the }l -calculus does not collapse to modal 
logic. Hence the same happens for 3-transitive graphs, in contrast with wellfounded transitive graphs 
(the case of 2-transitive graphs is open). Second, we show the infinity of the fixpoint hierarchy over 
P-transitive graphs, hence over 3-transitive graphs: this is again in contrast with transitive graphs, where 
the hierarchy collapses to alternation 2 (and again we do not know what happens for 2-transitive graphs). 

We remark that wellfoundedness is a rather strong property of systems, being equivalent to termi- 
nation of all computation paths; so wellfounded ^-transitive graphs seem to have a mostly theoretical 
interest (e.g. we may view them as generalizations of the deeply studied wellfounded transitive graphs), 
whereas arbitrary ^-transitive graphs, possibly with loops, are sufficiently general to model realistic net- 
works. 

We conclude the paper with some considerations on the model checking problem on P-transitive 
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graphs. Via a polynomial time reduction, we show that the 11 -calculus model checking problem for P- 
transitive or 3-transitive graphs is as difficult as for arbitrary graphs; we argue that for transitive graphs, 
finding such a polynomial time reduction (if any) would be a major breakthrough. 

2 Syntax 

2.1 Modal Logic 

In modal logic over a finite set A of atoms and one relation R, we have the modalities ( ) (diamond) and 
] (box). Sometimes we will have several relations /?i,i?2> • • •> i n which case disambiguating notations 
(Ri), etc. will be used, and similarly for boxes. We specify syntax for one relation modal logic as 
follows (syntax for many relations is analogous). 

::=a | ->a\ <pV<p \<f) A<p \ ()<p | []<j>, 

where a G A. 

The modal depth of a formula is md((j)), defined by: mdia) = md{-^a) = 0; md(-<<p) = md((j)); 
md(<p V <p') = md((j) A 0') = max(md(<p) ,md((j)')); and md(( }<p) = md{[ ]<p) = md(<p) + 1. 

For the purposes of the next sections, we find it convenient to fix an element P of A, together with 
its negation P, and to define four modalities (PP), (PP), (PP), (PP), whose meaning is: (PP)(j> = 
PA ( )(PA(j>), and similarly for the other three modalities. It is also convenient to write (P—}y for 
(PP)y\/ (PP)y, and similarly for (P— ), (— P) and (— P). Every diamond defined in this way has a 
corresponding box. 

2.2 The jU -calculus 

The jU -calculus is the extension of modal logic with two operators juX.0(X) and vX.0(X). So the syntax 
is 

::=a | ->a | X | (j) V0 | (j) A(j) | ( }(j) | [}<j) | juX.0(X) | vX.0(X), 

where X ranges over a countable set of variables. 

Without loss of generality, we can assume that for every variable X occurring in a formula there is 
only one subformula in of the form tiX.y or vX.i//. 

If X is a variable in a formula , and y is another formula, we can replace X with y everywhere in 
(j), as long as y does not contain free variables Y such that some occurrence of X is in the scope of vY or 
jlY in (j) (i.e. no capture can occur). The resulting formula is called a composition of and y. 

2.3 Fixpoint hierarchy 

The /i -calculus fixpoint hierarchy is given by the classes of formulas L n ,H n ,A n defined recursively as 
follows. 

• ITo = To is the class of formulas without fixpoints; 

• n„ + i is the closure of £„ U Yl n with respect to composition and greatest fixpoints; 

• £„ + i is the closure of £„ U IT,, with respect to composition and least fixpoints; 

• A n = z„nn„. 

The alternation depth of a formula (j>, denoted by ad(<p), is the least n such that € A„_(_i. 
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3 Semantics 

3.1 Graphs and Kripke semantics 

A graph is a pair G = (V,R) where V is a set of vertices and R is a relation on V. By means of graphs we 
can give a Kripke semantics for the /J. -calculus, extending the classical one for modal logic. We sketch 
the definition of the semantics, see e.g. (H for more details. 

We start with a graph G = (V,R) plus a valuation function vol from A to the powerset of V. 

The semantics of a formula (j> in (G,val) will be a set of vertices of the graph, defined inductively as 
follows. 

Atoms are interpreted by their valuations. Note that according to our stipulations, a vertex may verify 
several atoms, not necessarily just one. Boolean operators are interpreted as usual. For modal operators, 
( )(j) means that some successor satisfies 0, and [ ]<jt means that every successor satisfies 0. 

For fixpoints, fiX.$(X) is the least solution of the fixpoint equation X = 0(X), and vX.(j>(X) is the 
greatest solution of the equation, where X ranges over the subsets of V. 

For modal logic and the /i -calculus over several relations, the semantics is analogous, but it is based 
on multigraphs (V,R\ ,R2, ■ ■ ■), where R\,R2, ... are relations on V. 

We adopt the abbreviations (j> — > 1/A for implication and = \j/ for equivalence between formulas. 

3.2 Paths and trees 

Let G = (V,R) be a graph. If x,y are vertices of G, a finite path of length n from x to y is a sequence 
x = xqRx\Rx2 ■ ■ ■ Rx n = y. An infinite path is an infinite sequence xqRx\Rx2 ■ ■ ■ 

Given x,y 6 V, we say that x reaches y in n steps if there is a path of length n from x to y. 

A graph is called a tree if there is a vertex r such that for eveiy vertex v, there is a unique path from 
r to v. The vertex r is unique and is called the root of the tree. An example is the set {0, 1}* of all finite 
binary strings, where xRy holds if and only if x is a prefix of y and the length of y is the length of x plus 
one. The root is the empty string. 

A graph G is called wellfounded if it has no infinite path. G is called transitive if, whenever a vertex 
x reaches a vertex y, we have xRy. Transitive wellfounded graphs form the Godel-Lob class GL. 

3.3 fc-transitive graphs 

Let k be a positive integer. A graph G is called ^-transitive if whenever a vertex x reaches a vertex y in 
k + 1 steps, x reaches y in at most k steps. Sometimes, the smallest k such that G is ^-transitive is called 
the reachability diameter of G. 

Note that usual transitivity coincides with 1 -transitivity, and that for eveiy k, the property of being k- 
transitive is definable in first order logic. However, we will see that there are several differences between 
the model theoretic properties of transitive and ^-transitive graphs, at least for k > 3 (the border case 
k = 2 apparently needs to be worked out yet). 

4 P-transitive graphs 

In this paper we want to obtain some properties of ^-transitive graphs. To this aim we find it convenient 
to introduce a new class of approximately transitive graphs, which we call P-transitive graphs. Let 
G = (V,R,P,P, . . .) be a graph, vertex colored with two complementary atoms P and P (and possibly 
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other atoms). We could replace the atom P with -iP, but we prefer to consider P as an atom for notational 
reasons. 

We say that the P-color of a vertex is P, if the vertex satisfies P, and P otherwise. A graph G is called 
P-transitive if for every two vertices x,y of G, if x reaches y and x,y have the same P-color, then xRy. 
Lemma 4.1 Every transitive graph is P -transitive. Every P-transitive graph is 3-transitive. 

Proof: the first statement is easy. For the second, it is enough to prove that in a P-transitive graph, if 
x reaches y in 4 steps, then x reaches y in at most 3 steps as well. So let G be a P-transitive graph, and 
assume x reaches y in 4 steps, let the corresponding path be xRziRz2Rz3Ry. Among the five vertices there 
are three of the same color P or P. Suppose there are three P's. Then if we link the first and the last P, 
we have a path from x to y of length 3 or less. If there are three P's the reasoning is analogous. 

Q.E.D. 

Lemma 4.2 P-transitive graphs can be defined by a formula of first order logic. 

Proof: a graph is P-transitive if and only if the following weaker, first order condition holds: given 
two points x,y with the same P-color, if there is path from x to y of length 2 or 3, then xRy. In fact, 
assuming the condition we can show by induction on n > 3 that: for every two vertices x,y with the same 
P-color, if there is a path of length n, then xRy. The base case n = 3 is immediate. For the inductive step 
from m < n to n, with n > 4, consider x,y of the same color and a path of length n > 4 from x to y, and 
take the first 5 points. By case analysis, between them there are at least two points with the same color 
at distance 2 or 3 in the path, and if we link them, we get a path from x to y with a length m < n, hence 
the induction hypothesis applies. 

Q.E.D. 

Note that for every graph G colored with P and P, there is a unique smallest P-transitive graph 
containing G, which is obtained by linking all pairs of vertices x, y € G having the same P-color and such 
that x reaches y. This graph will be called the P-transitive closure of G, and will be denoted by PTC(G). 

By contrast, note that it is not possible to define a unique ^-transitive closure of a graph for k > 1. 
Consider for instance a graph G with vertices 1,2,3,4,5 and relations (1,2), (1,3), (2,4), (3,4), (4,5). 
Then we can add either (2,5) or (3,5) to make G 2-transitive, so there is no smallest 2-transitive graph 
containing G. 

By using the concept of P-transitive closure we can show the finite model property for P-transitive 
graphs: 

Lemma 4.3 If a fl-calculus formula <f> is true in some P-transitive graph, then it is true in some finite 
P-transitive graph. 

Proof: suppose is true in a P-transitive graph T . We can suppose that all diamonds are of the form 
( PP) or ( PP) or ( PP) or ( PP), and similarly for boxes. Let <p p be the result of replacing ( PP) y with 

(PP) ¥ V(P-){)*(-P)w 

and similarly for ( PP)y, where as usual, the Kleene star ()*tt means ptX.a V ( )X. 

Then <p p is also true in T and, by the finite model property of the /I -calculus, it is true in some finite 
graph F and also in PTC(F). Since PTC(F) is P-transitive, PTC(F) verifies 0. 

Q.E.D. 

Corollary 4.1 The \i-calculus is decidable on P-transitive graphs. 

Proof: by the small model property of the /I -calculus over arbitrary graphs, the graph F in the 
previous proof can be taken with size at most exponential in <j>, and the size of F and PTC(F) is the 
same, so we have a small model property also for P-transitive graphs. 

Q.E.D. 
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5 An undecidability result 

In the previous section we have shown that the jU -calculus is decidable on P-transitive graphs. Things 
change if one enriches the /I -calculus with additional constructs. In this section we consider essentially 
the same enriched /I -calculus considered in O and 0, and we prove that it is undecidable on P-transitive 
graphs by following O. 

More precisely, we consider the /I -calculus over one relation R, and we enrich it with the following 
operators: 

• N (standing for nominal), an atom whose interpretation in any graph must be a singleton; 

• the counting modalities ( ) >n <j), meaning that there are more than n successors verifying 0, and 
[]-"</>, meaning that there are at most n successors verifying not 0; 

• the inverse counting modalities ()~- >n <p, meaning that there are more than n predecessors verifying 
(j), and [ ]~'- n (j), meaning that there are at most n predecessors not verifying (p. 

We added above some counting modalities to the /i -calculus considered in JU, because they seem 
natural (in fact they appear in 0) and they are essential for our undecidability proof: in ||5] it is shown 
that, if we take only the trivial case n = in the modalities above, the resulting /I -calculus is decidable. 
On the other hand, in ||6] the enriched jj, -calculus is shown to be undecidable assuming to have several 
functional relations, whereas here we want to use one single relation, and in order to fit the spirit of this 
paper, we also insist that this relation must be P-transitive. So, in the same vein of |6), our result is: 

Theorem 5.1 The enriched ^.-calculus over a single P-transitive relation is undecidable. 

Proof: the idea is the same as [6]]: we simulate domino systems. Here are some details. 

A domino system is a triple D = (T,Hor, Vert), where T is a finite set of tile types and Hor, Vert C T 2 . 
Let N = {1,2,3, ...} be the set of all natural numbers. One says that D paves the grid N x N if there is a 
function (a paving) from N x N to T such that any two consecutive tiles sharing a horizontal side satisfy 
Hor, and any two consecutive tiles sharing a vertical side satisfy Vert. 

In analogy with |6), given a domino system D, we construct effectively an assertion Yd in the en- 
riched n -calculus over a single relation, such that D paves the grid if and only if Yd is satisflable by 
a P-transitive graph. Since it is undecidable whether a domino system paves the grid, the satisfiability 
problem for the enriched /I -calculus on P-transitive graphs is also undecidable. 

In (6l one considers the grid as a bigraph B=(Nx N,l,v,N), where we have two relations / and v 
corresponding to the left and vertical edges of the grid, and N denotes the origin of the grid. A paving of 
the grid is represented by predicates C t C N x N for each t 6 T. 

In our setting, the relations / and v are coded by a single P-transitive relation R plus four atoms as 
follows. We define the abed-grid as the grid plus a suitable vertex coloring with colors a,b,c,d. That 
is, we color the odd rows of the grid (starting from the first one) by a.b.a.b. . . and the even rows by 
c, d, c, d, In particular, the nominal N is decorated with a. We let also P = a U d and P = b U c. 

In (6l there is the construction of a /I -calculus formula 0o, such that a bigraph (V,l,v,Q,N) satisfies 
§d if and only if it is isomorphic to a paving of the grid. Note that j6j introduces also a third relation d, 
but d can be defined away in the grid as d = o {y~~ o/~)*) n (B v x B/,), where Z~ and v~ are the inverse 
relations, o denotes concatenation, * is the Kleene star and Bf, and B v are the horizontal and vertical axes 
of the grid (both axes are in turn /I -calculus definable in the grid). 

Now in a graph G = (V,a,b,c,d,R,C t ,N) we define the left relation l G = R n ((b x a) U (a x b) U 
(cxd)U(dxc)), and the vertical relation v G =fln((axc)U(cxa)U(bxd)U(dxb)). This gives 
also an auxiliary relation do via the definition above of d. 
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If we replace in <j>D the relations l,v with Ig,vg, we have a first jl -calculus formula Yd which holds 
on a graph G = (V,a,b,c,d,R,C t ,N) if and only if Icvcdc and their inverses are functional, and the 
associated bigraph Be = (V,Ig,vg,Q,N) satisfies (pp. In fact, each modality {Ig)& is definable as a A 
( )(bAa) VbA( )(aAa) VcA( )(dAa) VdA( )(cAa), and similarly for (v G ) and the inverse modalities. 

Note that, in order to express that the relations 1g,vg and their inverses are functional, we need 
counting modalities. For instance, Iq is functional if and only if we have the conditions a — > [ ]- b, 
b — > [ ]- ! a, c — >■ [ ]- d, d — > [ ]- c. This is why we added counting modalities with respect to (H. 
Likewise, functionality of the auxiliary relation dc and its inverse follows from functionality of Ig^g 
and their inverses. 

Also, note that Yd depends only on the restriction of P to (P x P) U (P x P). 
Moreover, the sets a b e d as defined in the abed-grid verify the following conditions: 

• a, b, c, d are a partition of the grid; 

• the origin is a, formally N — > a; 

• every a has a b father and a c son, formally a — > ( )~b A ( }c; 

• every node with a b son and a c father is a, formally ( )b A ( )~c — > a; 

• every b has an a father and a d son, and eveiy node with a d father and an a son is b; 

• every c has a d father and an a son, and every node with an a father and a d son is c; 

• every d has a c father and a b son, and every node with a b father and a c son is d. 

Note that all conditions above are modal; let y 2 be the conjunction of all these conditions, and let 
¥d = ¥d^ Y 2 - 

Now suppose Yd is satisfiable by a P-transitive graph. Let G = (V,a,b,c,d,R,C t ,N) be a P-transitive 
graph verifying Xf/rj. Then the bigraph (V,lG,VG,C t ,N) satisfies ipo and is isomorphic to a paving of the 
grid. 

Conversely, take a paving of the grid in D. Then there is a bigraph B = (V,a,b,c,d, l,v,Q,N) iso- 
morphic to a paving of the abed-grid. Define R C (N X N) 2 by R = PTC(lUv); then the graph G = 
(V,a,b,c,d,R,Q,N) satisfies y 2 . Now, we have / = l G and v = v G . So the bigraph B = (V,lG, v G,C t ,N) = 
B G satisfies (f> D , and G verifies \jf D as well, hence Yd = Wd^ ¥2 is satisfiable (by a P-transitive relation). 

Q.E.D. 

Corollary 5.1 The enriched ji-calculus over a single 3-transitive relation is undecidable. 
Proof: if Yd is satisfied by any relation P, then it is satisfied by the 3-transitive relation 

R' = PTC(R n ((P x P) U (P x P))). 

Q.E.D. 

6 A lower bound for wellfounded P-transitive graphs 

In this and the following sections we give some expressiveness results for the /I -calculus on P-transitive 
graphs and 3-transitive graphs. We begin with a result which demonstrates that the de Jongh-Sambin 
Theorem cannot be extended to our context. 

Theorem 6.1 The fx-calculus does not collapse to modal logic over wellfounded P-transitive graphs. 
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Proof: let WPT be the class of wellfounded P-transitive graphs. Denote by —>wpt an d =wpt impli- 
cation and equivalence in WPT. Let <p + be a pt -calculus formula saying that there is an alternating PP- 
path to some point verifying an atom Q, beginning with P. We can take = PA /J.X .QV (PP)X V (PP)X. 
Let ~ be the same property as but beginning with P. We note the equivalences (over arbitrary graphs) 

0+ =J p A (<2v()<n; 

<r =PA(ev04>+). 

Suppose for an absurdity that is modal on wellfounded P-transitive graphs. Let a be a modal 
formula of smallest modal depth such that a =wpt </> + - The following lemma helps us in simplifying a. 

Lemma 6.1 Let + —>wpt [ ]/o V 8, where 

5 = []5iV...V[]5„V()CiV...V()C OT V(7 ; 

and where O is a disjunction of atoms and negated atoms. Then either P implies [ ]jo V 8 in WPT, or (j> + 
implies 8 in WPT. 

Proof: suppose that P does not imply [ ]/o V 8 in WPT. Let M be a WPT model of + and N be a 
WPT model ofPA-i([]/oVc)). We can suppose that M and N have the same colors at the root. Let M' 
be the disjoint union of M and ,/V up to identifying the roots. Then M' is WPT and still verifies (f) + , so it 
verifies [ ]y V 8. Moreover M' cannot verify [ ]/o because it contains N, and likewise it cannot verify any 
box of 8, so M' verifies some diamond of 8; but ,/V does not satisfy any diamond of 8, hence by exclusion 
M satisfies some diamond of 8, and we conclude that M verifies 8, as desired. 

Q. E. D. 

Suppose that a is in conjunctive normal form (CNF). By applying several times Lemma loTTl we can 
rewrite a as a positive Boolean combination of atoms and diamonds. In fact, since a implies P, we can 
suppose that one conjunct of the CNF is P. If [ ]% V 8 occurs in the CNF, then we replace it with P, if 
the first case of the lemma applies, and with 8 if the second case applies. The formula we obtain is still 
equivalent to a. Iterating the procedure, we eliminate all boxes from the CNF. 

Now the next lemma helps us to eliminate some conjunctions from a. 

Lemma 6.2 Suppose that a conjunction 

7=aA()yi A...A()y„ 

is satisfiable in WPT and implies (f) + in WPT, where O is a conjunction of atoms and negated atoms. 
Then o contains P. Moreover either o contains Q, or P A ( )y implies (j> + in WPT for some i. 

Proof: since <p + implies P, y implies P in WPT. Hence, a contains P, otherwise we could take a 
WPT model of y and put P at its root, and the resulting model would be a WPT model of y with P at the 
root, contrary to the fact that y implies P in WPT. 

Suppose a does not contain Q. Suppose for an absurdity that there is a model M; in WPT which 
verifies P A ( )y but not + , for each i = 1, . . . ,n. Since Q does not occur in a, we can suppose that all 
Mi do not verify Q, have the same colors at the root, and these colors verify a. Let us merge Mi ... ,M n 
at the root. The resulting model is in WPT and verifies ybut not a contradiction. So P A ( )y implies 
+ in WPT for some i. 

Q.E.D. 
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By the previous results we have a modal formula a, a positive Boolean combination of atoms and 
diamonds, equivalent to + in WPT. Put a in disjunctive normal form. By applying several times 
Lemma [6721 we obtain a disjunctive normal form for a whose disjuncts have the form P A Q or P A ( )y. 
We note that a disjunct P A Q must be present, otherwise the one point model decorated with PQ would 
verify <p + but not a. So, by taking the disjunction, we can write 

4> + =wprPA(<2V()y). 

We want to prove 0~ =wpt /• 

First we show that y implies ~ in WPT. In fact, suppose for an absurdity that a WPT model M 
verifies y but not ~ . Take a fresh root decorated PA->Q and attach M as a child. Let N be the resulting 
model and let N' = PTC(N) be its P-transitive closure. Then N' verifies P A (Q V ( )y), hence A 7 ' verifies 
+ ; but the root of N' has no P child except possibly for the root of M, so N' verifies neither P A Q nor 
( }<j)~, hence A^' does not verify (j) + , a contradiction. In particular, y implies P in WPT. 

Now let us show that 0~ implies y in WPT. Suppose for an absurdity that a WPT model M verifies 
0~ but not y. As above, construct N and N'. Then N' verifies PA()(j)~ , hence N' verifies + and P A ( )y, 
but the root of Af' has no P child except for the root of M, so Af' does not verify ( ) y, a contradiction. 

Summing up, =wpt 7- Now we use a lemma: 

Lemma 6.3 Let a, (5 be two formulas containing an atom P and its negation P. Assume OC,f5 are equiv- 
alent in WPT. Let a' ,f5' obtained by swapping P and P in a and j3. Then a' and f3' are also equivalent 
in WPT. 

Proof: let M be a WPT model of a'. Let M' be obtained from M by swapping the valuations of P and 
P. Note that M' is still WPT . Then M' satisfies a, hence M' satisfies j8 because a and j8 are equivalent 
in WPT, and M satisfies j8'. So, a' implies j3' in WPT, and symmetrically, j8' implies a' in WPP, and 
the two formulas are equivalent in WPT . 

Q.E.D. 

Let y be the result of swapping P and P in y. By the previous lemma, we obtain y =wpt < t> + , but y 
has modal depth lesser than the starting formula a, contrary to the choice of a. This proves the theorem. 

Q.E.D. 

Corollary 6.1 The jj,-calculus does not collapse to modal logic over wellfounded 3-transitive graphs. 

7 Parity games 
7.1 Definition 

In the next section we will give a pt -calculus hierarchy result for P-transitive graphs. In this section we 
prepare the result of the next section by recalling parity games. 

Recall that a parity game is determined by a tuple G = (V = V c UVd,vo,E,£l) where V is a countable 
set of vertices, vo £ V is the initial vertex, V c ,Vd are two disjoint sets, £ is a binary relation on V, and 
Q. : V — > {0, . . . ,n} is a priority function. We choose to call the players c and d like [3] (where c stands 
for conjunction and d stands for disjunction). The play works as follows. Players c and d move along the 
graph. On Vd, player d moves; on V c , player c moves. If either has no move, the other wins. Otherwise, 
in an infinite play, d wins if the greatest priority seen infinitely often is even, and c wins otherwise. There 
is a jJ. -calculus £„ formula W n , due to Walukiewicz, which expresses the fact that player d has a winning 
strategy in the parity game associated to G. 
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7.2 Evaluation games 

Let A be a finite set of atoms. Let G be a countable graph vertex colored with A, let vo be a vertex of G, 
and consider a jU -calculus formula (j). Following essentially (2j, we define a parity game E(G,vo,<p) (the 
evaluation game), such that player d wins the game if and only if G,vq verifies <f>. The difference is that 
we simplify the definition of priority of a formula. 

The positions are pairs (v, y) where v is a vertex of the graph and y is a subformula of (f>. The initial 
position is (vo,0). The c positions are (v, yA%), (v, [ ]\ff), (v,X) and (v,oX.y), as well as (v,a) where 
a G A and v verifies a in G. The other positions are d positions. 

There are arrows from (v, y f\%) or (v, yV %) to (v,y) and (v,x)- There are arrows from (v, [ ]y) 
or (v, ( }y) to (w,y) for every successor w of v. There are arrows from (v,X) to (v,aX.y) and from 
(v,aX.y) to (v,y). 

The priority of a position (v, y) depends only on y. The priority of formulas which are not fixpoints 
is 0. The priority of vX.% is ad(vX.x), if this number is even, and ad(vX.%) — 1 if it is odd; the priority 
of /J.X.X is ad(llX.%), if this number is odd, and ad{jlX.%) — 1 if it is even. 

7.3 P-Parity games 

We find it convenient to introduce an ad hoc variant of parity games for P-transitive graphs, called P- 
parity games. The definition is the same as for parity games, except that vertices are partitioned in 
P-states and P-states, and only moves from P to P or from P to P are allowed. There is a jU -calculus £„ 
formula P — W n , similar to the usual parity game formula of Walukiewicz, which expresses the fact that 
player d has a winning strategy in the P-parity game associated to a graph G. 

8 A hierarchy result 

Theorem 8.1 The ^-calculus fixpoint hierarchy is infinite on P -transitive graphs. 
Proof: for every positive integer n define a set of atoms 

A n = {c,d} x {0,...,n} x {P,P}. 

Let M n the metric space of all complete binary trees labeled with A n , that is, the functions from {0, 1}* 
to A n , where the root is labeled P and P,P alternate along every path. Note that in this case, each vertex 
verifies exactly only one atom (this is not always the case in our semantics of the jU-calculus). The 
distance function in M n is defined as d(T,T') = l/2 k if T, T coincide up to depth k but not on higher 
depth, and d(T, T') = if they are equal. A contraction of M n is defined as a map / : M n — > M n such that, 
for some constant c < 1, 

d(f(T),f(T'))<c-d(T,T'). 

Let T S M„. Let be a pt -calculus formula over the alphabet A n of class E„. We construct an 
incomplete binary tree / = I(T,<j>) over A n such that PTC(T) models if and only if I(T,<j>) verifies 
P — W n . The idea is to encode the evaluation game E(PTC(T),Q) in the tree /. 

We define partial binary trees I(T,u, y), with alternating P-colors, where u is a vertex of T and y is 
a subformula of 0, according to the following rules. For brevity in this definition we denote I(T, u, y) by 
I(u,y). 

If Q G A n , we let I(u, Q) be a complete binary tree labeled (d,0) if T,u verifies Q, and (c, 1) if T, u 
does not verify Q. If X is a variable we let l(u,X) be a node labeled (c,0) with a child where we attach 
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the tree I(u, aX.y). If y = oX.%, then I(u, y) is a node labeled (c,p(oX.x)) (here p denotes priority) 
with a child where we attach the tree I{u,%). 

If y = W\ V V / 2> then I(u, y) is a node labeled (d,0) with two children where we attach I(u, yi) and 
I(u, 1//2). If y = V^i A y/i2> then 7(m, !//■) is a node labeled (c,0) with two children where we attach Z(w, 1/^1) 
and Z(m, Xfe)- 

For modalities, we suppose that ( )cc is replaced everywhere in with (PP)a V (Pi 3 ) V a V (PP)a V 
(PP)a, so that it is enough to consider the four modalities above, and similarly we proceed with boxes. 

If i// = (PP)x, or = {PP)%, and P,m does not satisfy P, then we let /(«, yi) be a complete binary 
tree labeled (c, 1) (in fact, in this case y is trivially false). Likewise we proceed if y = (PP)%, or 
y = {PP)%, and T,u does not satisfy P. Assume y = {PP)%, and T,u satisfies P, or y = {PP)%, and 
T,u satisfies P; let v,w be the children of u in T; then we let I(u, y) be a node labeled (d,0) with two 
children I{v,x) and 7(w,^). 

If y = [PP]x> or V = [PP]% and P, w does not satisfy P, then we let I(u, y) be a complete binary tree 
labeled (d,0) (in fact, in this case y is trivially true). Likewise we proceed if y = [PP]%, or y = \PP]%, 
and T,u does not satisfy P. Assume l/f = [PP]x, and P,« satisfies P, or y = [PP]%, and T, u satisfies P; 
let v,w be the children of u in T; then we let I(u, y) be a node labeled (c,0) with two children I(v,x) and 

P/je most delicate point are the rules for the modalities (PP) in a P -point, (PP) in a P -point, and the 
corresponding boxes. 

We must ensure that the construction is a contraction in the metric space M n . The idea is to "stretch" 
the coding tree. To this aim we consider the set E C {0, 1}* of all positions of even height in the binary 
tree. To each e E E we assign an integer n(e) so that: 

• n(e) is greater than the height of e; 

• e ^ e' implies n[e) ^n{e'). 

Assume y = {PP)%, and T, u satisfies P. For e € E, let u e be the P-successor of u with position e 
in the subtree T, u. Then I(u, y) is a node labeled (d,0) with an an infinite alternating chain, where for 
every eg£, the tree I(u e ,x) is attached as a child at position n{e). The vertices of the chain are labeled 
(d, 1) (so that d is forced to exit the chain eventually, otherwise he loses). 

An analogous rule applies when y = {PP)x> and T, u satisfies P, where P-successors are considered 
instead of P-successors. 

Likewise, assume y = [PP]x, and T,u satisfies P. Then I(u, y) is a node labeled (c,0) with an an 
infinite alternating chain, where for every e££, the tree I(u e ,x) is attached as a child at position n(e). 
The vertices of the chain are labeled (c,0) (so that c is forced to exit the chain eventually, otherwise he 
loses). 

An analogous rule applies when y = \PP]x, and T, u satisfies P, where P-successors are considered 
instead of P-successors. 

We let I§ (T) = I(r, 0), where r is the root of T, and where r is decorated with P. In order to obtain 
an element of M n , i.e. a complete binary tree, we transform h(T) to G$(T) as follows: 

• if a node v labeled c has only one child, we attach to v a second child with a complete binary tree 
labeled (c,0) (so that c loses if he follows the second child); 

• if a node v labeled d has only one child, we attach to v a second child with a complete binary tree 
labeled (d, 1) (so that d loses if he follows the second child). 

Now, as usual we have a contraction property: 
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Lemma 8.1 G^ is a contraction in the complete metric space M n . 

Proof: first we show that, if two rooted trees (T, u) and (T',u') are equal up to depth k, then I(T,u, y) 
and I(T\ u' , yr) are equal up to depth k + 1. This can be shown by induction on k. We consider only the 
case y = {PP)X- 

Suppose (T,u) and (T',u!) are equal up to depth k. Let v be a P-node of T at some distance d v < k 
from //. Let v' be a node of 7 1 ', such that the position of v' in the binaiy tree rooted in u' is the same 
position of v in the binary tree rooted at u. Then (T,v) and (T',v') are equal up to depth k — d v . By 
inductive hypothesis, I(T,v,x) and /(7 1 ', v',^) are equal up to k — d v + 1. Now the truncation of I(T,u,\j/) 
to level fc+ 1 is a chain where some of the trees I(T,v,x) are attached at distances D v > d v from m; and 
the truncation of I(T',u',y) to level k + 1 is also a chain where the corresponding trees I(T',v',x) are 
attached at distance D v from u' . So, the truncations of I(T, u, y) and l(T',u', \\f) at levels k + 1 are equal. 

In particular, if two trees T,T' are equal up to depth k, then G^{T),G^{T') are equal up to depth 
k + 1, and is a contraction of M„ with constant 1/2. 

Q.E.D. 

By the previous lemma, the usual argument of [3] applies. That is, suppose -<(P — W n ) is equivalent 
to a formula € £„ on P-transitive graphs. Then for every element T G M„ we have: 

prc(r) \=(j>^G^(T) hP-Wn, 

and since P-parity games allow only moves from P to P and conversely, we have 

PTC(T) \= o PTC(G${T)) ^P-W n . 
Now by the Banach Fixpoint Theorem we can pick Tq G M„ such that 7b = (7b), and we have: 

prc(Po) \=^(p-w n ) ^ppc(Po) h^-w n , 

a contradiction. Hence, P — W n cannot be IT,, on P-transitive graphs, and the hierarchy is infinite. 

Q.E.D. 

Corollary 8.1 The jj,-calculus fixpoint hierarchy is infinite on 3-transitive graphs. 

As a further corollary, we have that Theorem 4.57 of ifTTI does not extend to finite P-transitive or 
finite 3-transitive frames. In fact, let ML* be the modal logic where the modalities are those considered 
in Observation 4.26 of iPTD : that is, if (j> is a formula and p is a finite set of propositional formulas (i.e. 
formulas without modalities or fixpoints), then the modality ( )*<j> means that there is an infinite path 
from the current point along which <p and all propositional formulas in p are true infinitely often (note 
that here * does not quite denote the Kleene star, but something similar). 

We have: 

Corollary 8.2 On finite P-transitive or 3-transitive graphs, the bisimulation invariant fragment of 
Monadic Second Order Logic does not coincide with ML*. 

Proof: ML* is a fragment of the pt -calculus with alternation depth 2, so by the previous corollary, 
ML* does not subsume the /I -calculus, and a fortiori it does not subsume the bisimulation invariant 
fragment of MSO, over finite P-transitive or 3-transitive graphs. 

Q.E.D. 
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9 On model checking P-transitive graphs 

One of the most important open problems in /i -calculus is the complexity of the model checking problem: 
given a finite graph and a formula, decide whether the graph satisfies the formula. 11141 gives a UP upper 
bound, where UP is the class of nondeterministic polynomial Turing machines with at most one accepting 
path on each input. Moreover, |[T3l gives a subexponential algorithm. However, it is open whether the 
problem is solvable in polynomial time. 

We note that there is a natural polynomial time reduction from the 11 -calculus model checking prob- 
lem on arbitrary finite graphs to the 11 -calculus model checking problem on finite P-transitive graphs. 
More precisely: 

Theorem 9.1 Let G be a graph and let § be a \i-calculus formula. There is a P-transitive graph G', 
computable in polynomial time from G, and a formula <j>', computable in polynomial time from <j>, such 
that G models (j) if and only ifG' models (f)'. 

Proof: Let P be an atom not occurring in (j>. Call <j>' the result of replacing every diamond ( )\jf of 
with ( PP) y V ( PP)y, and similarly for boxes. 

The graph G' is defined as follows. The vertices are the pairs (v,P) and (v,P), where v is a vertex 
in G. We put an edge between (v,P) and (w,P), and one between (v,P) and (w,P), if there is an edge 
between v and w in G. Finally we put an edge between (v,P) and (w,P), and between (v,P) and (w,P) 
for eveiy pair of vertices v, w of G. 

We note that, in order to verify (j)' in G', it is enough to consider an alternating model checking game 
for (j)' in G', alternating in the obvious sense, and a player wins such an alternating game in G' if and 
only if the player wins the ordinary model checking game for (f> in G. So, G models if and only if G' 
models (j)'. 

Q.E.D 

Corollary 9.1 The model checking problem for \l-calculus on arbitrary graphs reduces in polynomial 
time to the model checking problem on 3-transitive graphs. 

We note that proving the theorem above with G' transitive, rather than P-transitive, would be a major 
breakthrough. In fact, on transitive graphs, every pt -formula is equivalent to one with alternation depth 
2, so by the algorithm of lH2l . the model checking problem for a transitive graph G and a formula is 
quadratic in G (this is only true for every fixed formula, because we must have the time to translate a 
formula into another with alternation depth 2, a translation which may take exponential time). So, if we 
could construct a transitive graph G' in polynomial time from G and a formula (j)' in polynomial time 
from such that G models (j> if and only if G' models 0', then the time complexity of the model checking 
problem would have an upper bound polynomial in G with a degree independent from (j> (again plus the 
time, possibly exponential in 0, spent in reducing to a formula of alternation depth 2); hence, we would 
be very close to proving the conjecture that the model checking problem is solvable in polynomial time. 

However, as noted by a referee, we cannot expect that a collapse of ii -calculus to formulas of low 
alternation depth is sufficient to have a polynomial time model checking algorithm: an example in this 
sense is measured pt -calculus, see 10, where variables range over measures on a set rather than subsets 
of a set. Every /I -calculus formula is equivalent to a measured /I -calculus formula with least fixpoints 
only (i.e. without greatest fixpoints), but this is not sufficient to have a polynomial time model checking 
algorithm for the pt -calculus. 
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10 Conclusion 

In this paper we have introduced a class of graphs, called P-transitive graphs, and we have begun the 
study of its model theoretic properties. A possible development could be in the style of fiTI . For 
instance, this last paper gives a lot of results on bisimulation invariant fragments of first order logic on 
various classes of transitive graphs, and one can ask to what extent the theory carries over to P-transitive 
graphs or ^-transitive graphs. 

We note that, like for transitive graphs, finite irreflexive P-transitive graphs coincide with finite well- 
founded P-transitive graphs. For this class of graphs, probably the theory of ifTTI applies, and in particular 
Theorem 4. 1 1 and its proof go through, just by replacing everywhere transitive closure with P-transitive 
closure (whereas, for ^-transitive graphs, we have the problem of the non-uniqueness of the ^-transitive 
closure). 

A challenging task in the same vein would be to find the bisimulation invariant fragment of first order 
logic for finite P-transitive graphs or ^-transitive graphs. 

Note that for the class of all (possibly infinite) P-transitive graphs, the bisimulation invariant fragment 
of first order logic is modal logic, because the class of P-transitive graphs is first order definable and van 
Benthem's Theorem applies, see ifTTTl . The same holds for ^-transitive graphs. 

We have seen that the extended modal logic ML* used in IfTTTl for finite transitive graphs is not 
sufficient to capture bisimulation invariant monadic second order logic on finite P-transitive graphs or k- 
transitive graphs. Probably the same happens for bisimulation invariant first order logic, because strongly 
connected components in these graphs are too complicated to be described by formulas of ML*. However, 
one can look for other fragments of the /I -calculus with bounded alternation depth which can replace ML* 
in this respect. 

Finally, an application of this paper to transitive graphs is expected: it seems plausible that the 
undecidability result in Theorem 15.1 I for P-transitive relations can be strenghtened to transitive relations, 
with a similar coding trick. In fact, the grid can be represented by a relation where every vertex has 
only entering or only exiting edges: such a relation is vacuously transitive. However this result will be 
possibly presented elsewhere. 
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